Search: CVE-2026-95101

CVE-2026-95101 is a medium severity vulnerability in F5 NGINX Plus and NGINX Open Source affecting the ngx_http_v3_module. When HTTP/3 is used with the proxy_request_buffering directive enabled, an unauthenticated attacker may inject data into the proxied request. This is a data plane issue without control plane exposure. The vulnerability affects multiple versions of NGINX Plus and Open Source as specified. No known exploits are reported in the wild. Versions that have reached End of Technical Support are not evaluated.